Process: PR attribution must derive from session identity, not prior PR templates (#124 incident)

[satwareAG-ironMike]

Incident

PR #124 was filed with the disclosure footer copied verbatim from sync PR #116, including @DietrichGebert - an account never verified against the current session's authenticated identity (satwareAG-ironMike / Michael Wegener). The user challenged it; the footer was corrected via gh pr edit 124.

Root cause

Template inheritance without identity verification. A disclosure line is a session-scoped factual claim about who is being represented - not boilerplate.

Guardrail (standing rule)

1. Before gh pr create, resolve the operator via gh api user (or git config user.name) in the current session.
2. Attribution footers name the resolved identity only.
3. Any human name inherited from a prior PR/template is replaced or the template is rejected.

Durable fixes applied (2026-09-15)

Location	Change
harness docs/learnings/2026-09-15-pr-attribution-template-copy.md	Incident record + negative control
github skill anti-patterns	Attribution-from-template row
spec-kit skill	Attribution rule + sync procedure corrected to sync-branch + PR pattern (old force-push flow retired)

No code change required in this repo; PR #124 footer already corrected.